Null dereference in print_odf_element function
- Dominant language
- C
- Stars
- 709
- Forks
- 139
- PR merge metrics
- No merged PRs in 30d
Description
## Problem Description
Note: I am aware that this project is unmaintained. However, I am still opening this issue to follow [CVE's guidelines for EOL software](https://www.cve.org/Resources/General/End-of-Life-EOL-Assignment-Process.pdf).
There is a null dereference in the `print_odf_element` function when the parser handles a specially crafted Markdown file. This could be used to perform a denial-of-service attack.
Here is a minimized proof-of-concept Markdown file that triggers the bug: [min_null_deref_print_odf_element.md](https://github.com/jgm/peg-markdown/files/12413267/min_null_deref_print_odf_element.md).
The output is as follows:
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==761952==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000005db3b7 bp 0x000000000014 sp 0x7fffffffe030 T0)
==761952==The signal is caused by a READ memory access.
==761952==Hint: address points to the zero page.
#0 0x5db3b7 in print_odf_element /home/sanic/peg-markdown/markdown_output.c:1072:42
#1 0x5dac3a in print_odf_element_list /home/sanic/peg-markdown/markdown_output.c:892:9
#2 0x5dac3a in print_odf_element /home/sanic/peg-markdown/markdown_output.c:1054:9
#3 0x5d4c0a in print_odf_element_list /home/sanic/peg-markdown/markdown_output.c:892:9
#4 0x5d4c0a in print_element_list /home/sanic/peg-markdown/markdown_output.c:1146:26
#5 0x5dca53 in markdown_to_g_string /home/sanic/peg-markdown/markdown_lib.c:163:5
#6 0x5dce84 in markdown_to_string /home/sanic/peg-markdown/markdown_lib.c:175:11
#7 0x4c4d06 in main /home/sanic/peg-markdown/markdown.c:180:11
#8 0x7ffff7b25082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
#9 0x41c50d in _start (/home/sanic/peg-markdown/markdown+0x41c50d)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/sanic/peg-markdown/markdown_output.c:1072:42 in print_odf_element
==761952==ABORTING
```
## Reproduction Steps
1. Compile the project using ASAN (Address Sanitizer). For example, `CC=afl-clang-fast AFL_USE_ASAN=1 make`.
2. Run `./markdown --to=odf min_null_deref_print_odf_element.md` (use the proof-of-concept file attached to this report).
3. Observe the null dereference in the output.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.